$ ./sshUserSetupNT.sh -user oracle -asUser Administrator -asUserGrp SYSTEM -hos
ts "ferrari" -localPlatform win -sshLocalDir "C:\cygwin\.ssh" -homeDir $HOME
The output of this script is also logged into /tmp/sshUserSetup_2011-04-18-13-40
-52.log
Hosts are ferrari
user is oracle
Checking if the remote hosts are reachable
Pinging ferrari.dbsoft.local [172.16.1.3] with 32 bytes of data:
Reply from 172.16.1.3: bytes=32 time=1ms TTL=64
Reply from 172.16.1.3: bytes=32 time<1ms TTL=64
Reply from 172.16.1.3: bytes=32 time<1ms TTL=64
Reply from 172.16.1.3: bytes=32 time<1ms TTL=64
Reply from 172.16.1.3: bytes=32 time=1ms TTL=64
Ping statistics for 172.16.1.3:
Packets: Sent = 5, Received = 5, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 1ms, Average = 0ms
Remote host reachability check succeeded.
The following hosts are reachable: ferrari.
The following hosts are not reachable: .
All hosts are reachable. Proceeding further...
firsthost ferrari
numhosts 1
The script will setup SSH connectivity from the host VM8ORALCOLABOR to all
the remote hosts. After the script is executed, the user can use SSH to run
commands on the remote hosts or copy files between this host VM8ORALCOLABOR
and the remote hosts without being prompted for passwords or confirmations.
NOTE 1:
As part of the setup procedure, this script will use ssh and scp to copy
files between the local host and the remote hosts. Since the script does not
store passwords, you may be prompted for the passwords during the execution of
the script whenever ssh or scp is invoked.
NOTE 2:
AS PER SSH REQUIREMENTS, THIS SCRIPT WILL SECURE THE USER HOME DIRECTORY
AND THE .ssh DIRECTORY BY REVOKING GROUP AND WORLD WRITE PRIVILEDGES TO THESE
directories.
Do you want to continue and let the script make the above mentioned changes: yes
/no?
yes
The user chose yes
Please specify if you want to specify a passphrase for the private key this scri
pt will create for the local host. Passphrase is used to encrypt the private key
and makes SSH much more secure. Type 'yes' or 'no' and then press enter. In cas
e you press 'yes', you would need to enter the passphrase whenever the script ex
ecutes ssh or scp.
The estimated number of times the user would be prompted for a passphrase is 2*1
. In addition, if the private-public files are also newly created, the user woul
d have to specify the passphrase on one additional occasion.
Enter 'yes' or 'no'.
yes
The user chose yes
The files containing the client public and private keys already exist on the loc
al host. The current private key may or may not have a passphrase associated wit
h it. In case you remember the passphrase and do not want to re-run ssh-keygen,
press 'no' and enter. If you press 'no', the script will not attempt to create a
ny new public/private key pairs. If you press 'yes', the script will remove the
old private/public key files existing and create new ones prompting the user to
enter the passphrase. If you enter 'yes', any previous SSH user setups would be
reset. If you press 'change', the script will associate a new passphrase with th
e old keys.
Press 'yes', 'no' or 'change'
yes
The user chose yes
Creating .ssh directory on local host, if not present already
Creating config file on local host
If a config file exists already at C:\Users\Administrator\.ssh\config, it would
be backed up to C:\Users\Administrator\.ssh\config.backup.
Removing old private/public keys on local host
Running SSH keygen on local host
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Generating public/private rsa key pair.
Your identification has been saved in C:\Users\Administrator\.ssh\identity.
Your public key has been saved in C:\Users\Administrator\.ssh\identity.pub.
The key fingerprint is:
4c:8a:08:c4:19:b9:de:91:3e:4b:6d:e4:0e:a7:4c:a0 Administrator@VM8ORALCOLABOR
The key's randomart image is:
+--[ RSA 1024]----+
|.o+ |
|.+ |
|. . . . |
| + + o + |
|o = * . S |
|E. B = |
| + O |
| + . |
| |
+-----------------+
Creating .ssh directory and setting permissions on remote host ferrari
THE SCRIPT WOULD ALSO BE REVOKING WRITE PERMISSIONS FOR group AND others ON THE
HOME DIRECTORY FOR oracle. THIS IS AN SSH REQUIREMENT.
The script would create ~oracle/.ssh/config file on remote host ferrari. If a co
nfig file exists already at ~oracle/.ssh/config, it would be backed up to ~oracl
e/.ssh/config.backup.
The user may be prompted for a password here since the script would be running S
SH on host ferrari.
Password:
Password:
Done with creating .ssh directory and setting permissions on remote host ferrari
.
Copying local host public key to the remote host ferrari
The user may be prompted for a password or passphrase here since the script woul
d be using SCP for host ferrari.
ssh: Could not resolve hostname C: hostname nor servname provided, or not known
Done copying local host public key to the remote host ferrari
The script will run SSH on the remote machine ferrari. The user may be prompted
for a passphrase here in case the private key has been encrypted with a passphra
se.
Password:
SSH setup is complete.
------------------------------------------------------------------------
Verifying SSH setup
===================
The script will now run the 'date' command on the remote nodes using ssh
to verify if ssh is setup correctly. IF THE SETUP IS CORRECTLY SETUP,
THERE SHOULD BE NO OUTPUT OTHER THAN THE DATE AND SSH SHOULD NOT ASK FOR
PASSWORDS. If you see any output other than date or are prompted for the
password, ssh is not setup correctly and you will need to resolve the
issue and set up ssh again.
The possible causes for failure could be:
1. The server settings in /etc/ssh/sshd_config file do not allow ssh
for user oracle.
2. The server may have disabled public key based authentication.
3. The client public key on the server may be outdated.
4. ~oracle or ~oracle/.ssh on the remote host may not be owned by oracle.
5. User may not have passed -shared option for shared remote users or
may be passing the -shared option for non-shared remote users.
6. If there is output in addition to the date, but no password is asked,
it may be a security alert shown as part of company policy. Append the
additional text to the <OMS HOME>/sysman/prov/resources/ignoreMessages.txt file.
------------------------------------------------------------------------
--ferrari:--
Running /usr/bin/ssh -x -l oracle ferrari date to verify SSH connectivity has be
en setup from local host to ferrari.
IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE
PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL. Pleas
e note that being prompted for a passphrase may be OK but being prompted for a p
assword is ERROR.
The script will run SSH on the remote machine ferrari. The user may be prompted
for a passphrase here in case the private key has been encrypted with a passphra
se.
Password:
Mon Apr 18 16:51:12 EDT 2011
------------------------------------------------------------------------
SSH verification complete.
Setting up ssh euivalence for user Administrator
Copying files from C:\Users\Administrator\.ssh to C:\cygwin\.ssh
Done.
Administrator@VM8ORALCOLABOR /cygdrive/c/oracle/middleware/oms11g/sysman/prov/re
sources/scripts
$ ssh -l Administrator ferrari
Password:
Password:
Administrator@VM8ORALCOLABOR /cygdrive/c/oracle/middleware/oms11g/sysman/prov/re
sources/scripts
$ ssh -l oracle ferrari
Password:
Last login: Mon Apr 18 16:36:18 2011 from 172.16.1.64
[oracle@ferrari ~]$

I found the same thing just a few minutes ago where they mention that sshUserSetupNT.sh should be used prior to OMS 10.2.0.2.

But I'm running into problems with the script with the hosts. I've check C:\Windows\System32\etc\hosts and I have entries for this host in there.
I can ping and ssh to it. But when I include it in the script I get the same error as below.

Try setting you oracle_home to the <OMS_home>
Due to a Cygwin bug you may have to put the <OMS_home> between "".
You may also have to add -remotePlatform <platform id> for the platform of your target server (I'm not sure if this is really needed, since the remote platform <> local platform) In your case this would be 226 or 46
The platform id can be found here <OMS_HOME>/sysman/prov/resources/platforminfo.properties

Eric

Oh, btw if you are setting this up for just a few servers others methods (like agent cloning) are far more easy to use.

So I've managed to move a step forward, or maybe back. I did what you suggested and now its planting on the same command at line 316 (-areNodesAlive) but with a C:/Program No such file.
I think thsi is because of the JDK. With does not work when I set it up as requested.

So I decided to point it to the ORGINAL ORACLE_HOME JDK which throws another error for now class found. But the path is completely wrong and I have no clue where it is getting it as oracle/sysman/prov/ssh does not exist

I think you have to check one option you entered.
localPlatformGrp 226 This can only be unix or win. The default for this option is unix. Specify this option if the local OMS platform is Windows and use the argument win. So stick to win since OMS is on Windows.
You did use the "" around ORACLE_HOME and also the JAVAHOME?
For the host it is best to use the FQDN: ferrari.dbsoft.local

So I figured I'm doing something wrong. Deleted the entire cygwin and started from scratch. Maybe you or another PRO might see something I'm doping wrong. I've been stuck on this 3 DAYS !.
Platform is Windows 2008 64. Either I missed something in the documentation or there is somethign terribly wrong with OMS.

I am attempting to setup the agent for grid control / cygwin on 2008R2. I looked at both the old 11g and newer 12c documentation. I swear no one at Oracle ever used it to configure an agent, as it contains fundamental flaws.

So I realized that for step 6 you need to open (as administator) the cygwin terminal and type:

bash
ssh-host-config

(not bashssh-host-config (11g) or -bash -ssh-host-config)

Then the setup starts. Cygwin asks for several things that don't match the documentation. This may be because it is a newer version - but you can't (easily at least) get an older version.

Example: Instead of typing CYGWIN="binmode tty ntsec" you just type binmode tty ntsec at the "Enter the value of CYGWIN for the daemon:" prompt.

So... Why isn't Cygwin bundled? Is Oracle saying to use this software but isn't paying the Cygwin maintainers anything to allow them to bundle it?

So anywho - my basic questions (so far) are:

1. Who should I be running setup/service this as?

Although my databases are on servers that are on a domain, we only have local admin accounts (not domain). I don't have a cyg_server user and if I choose to use my admin account user - it says it does not have the necessary privileges. But if I ignore this it seems to make that user. So am I good?

2. Related to #1 - we are instructed to use CYGWIN="binmode tty ntsec". << NTSEC I think is assuming domain accounts for machine to machine use right? This won't most likely work - even with the listener I have to use NONE since with NTS I cannot then connect from a normal user account to the database.

Any assistance is gratefull - I can go though the pain of oracle support - but if someone has tips/better docs that will probably be faster (and help others that arive here via search with the same issues).

Now... having muddled my way through (hopefully with the right choices) to step 8 and I am presented with:

"If your user... is a domain user, do the following:"

Nope, just a local user. Where is the ELSE?

<soapbox on>
Hello Oracle - there is NOTHING about what to do if it is not a domain user.

Please fire your documentation and QA people for this product. Talk about user vicious software (and manual)... And we paid what for this pleasure?

Sorry, but this is really pisspoor stuff. Oracle documentation is generally lacking, especially in examples, but this really takes the cake. What changes there are between 11 and 12 are still wrong, just different.
</soapbox off>